linux.git/drivers/media/platform, branch v3.18.72

media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl

2017-08-11T16:30:14+00:00

commit da05d52d2f0f6bd61094a0cd045fed94bf7d673a upstream.

this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works
for vpfe_capture driver with a minimal patch suitable for backporting.

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Due to these reasons we make sure this ioctl now returns -EINVAL and backport
this patch as far as possible.

Fixes: 5f15fbb68fd7 ("V4L/DVB (12251): v4l: dm644x ccdc module for vpfe capture driver")

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

s5p-mfc: Fix unbalanced call to clock management

2017-05-25T12:18:00+00:00

commit a5cb00eb4223458250b55daf03ac7ea5f424d601 upstream.

Clock should be turned off after calling s5p_mfc_init_hw() from the
watchdog worker, like it is already done in the s5p_mfc_open() which also
calls this function.

Fixes: af93574678108 ("[media] MFC: Add MFC 5.1 V4L2 driver")

Signed-off-by: Marek Szyprowski 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

s3c-camif: fix compiler warnings

2017-02-08T08:43:04+00:00

commit 7e0d4e92269e574e50a58041fac4cc75a149828c upstream.

Fix these compiler warnings that appeared after switching to gcc-5.1.0:

drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_power':
drivers/media/platform/s3c-camif/camif-capture.c:118:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.power_count)
          ^
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_streaming':
drivers/media/platform/s3c-camif/camif-capture.c:134:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.stream_count)
          ^

Signed-off-by: Hans Verkuil 
Cc: Kamil Debski 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

s5p-mfc: Add release callback for memory region devs

2016-08-22T16:22:57+00:00

[ Upstream commit 6311f1261f59ce5e51fbe5cc3b5e7737197316ac ]

When s5p_mfc_remove() calls put_device() for the reserved memory region
devs, the driver core warns that the dev doesn't have a release callback:

WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.

Also, the declared DMA memory using dma_declare_coherent_memory() isn't
relased so add a dev .release that calls dma_release_declared_memory().

Cc: 
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas 
Tested-by: Marek Szyprowski 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Sasha Levin

s5p-mfc: Set device name for reserved memory region devs

2016-08-22T16:22:57+00:00

[ Upstream commit 29debab0a94035a390801d1f177d171d014b7765 ]

The devices don't have a name set, so makes dev_name() returns NULL which
makes harder to identify the devices that are causing issues, for example:

WARNING: CPU: 2 PID: 616 at drivers/base/core.c:251 device_release+0x8c/0x90
Device '(null)' does not have a release() function, it is broken and must be fixed.

And after setting the device name:

WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.

Cc: 
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas 
Tested-by: Marek Szyprowski 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Sasha Levin

[media] v4l: vsp1: Set the SRU CTRL0 register when starting the stream

2016-07-12T12:47:44+00:00

[ Upstream commit f6acfcdc5b8cdc9ddd53a459361820b9efe958c4 ]

Commit 58f896d859ce ("[media] v4l: vsp1: sru: Make the intensity
controllable during streaming") refactored the stream start code and
removed the SRU CTRL0 register write by mistake. Add it back.

Fixes: 58f896d859ce ("[media] v4l: vsp1: sru: Make the intensity controllable during streaming")

Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] v4l: vsp1: Fix VI6_WPF_SZCLIP_SIZE_MASK macro

2015-12-03T14:58:08+00:00

[ Upstream commit 03b36e4dcf422a10da8b67bce2ed00b34ec58aac ]

Clipping size bit of VI6_WPFn _HSZCLIP and VI6_WPFn _VSZCLIP register are from
0 bit to 11 bit. But VI6_WPF_SZCLIP_SIZE_MASK is set to 0x1FFF, this will mask
until the reserve bits. This fixes size for VI6_WPF_SZCLIP_SIZE_MASK.

Signed-off-by: Nobuhiro Iwamatsu 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] v4l: vsp1: Fix VI6_DPR_ROUTE_FP_MASK macro

2015-12-03T14:57:57+00:00

[ Upstream commit 1aa7890324b497f96f07c20673fae58f26fabfe7 ]

FP bit of VI6_DPR_mod_ROUTE register is 6bit. But VI6_DPR_ROUTE_FP_MASK is set
to 0xFF, this will mask until the reserve bit.
This fixes size for VI6_DPR_ROUTE_FP_MASK.

Signed-off-by: Nobuhiro Iwamatsu 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] v4l: vsp1: Fix VI6_DPR_ROUTE_FXA_MASK macro

2015-12-03T14:57:47+00:00

[ Upstream commit 45008ee9295b3ae96d7413ab91871907a671ca82 ]

FXA bit of VI6_DPR_mod_ROUTE register starts from 16bit. But VI6_DPR_ROUTE_FXA_MASK
is set to become start from 8bit. This fixes shift size for VI6_DPR_ROUTE_FXA_MASK.

Signed-off-by: Nobuhiro Iwamatsu 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] v4l: omap3isp: Fix sub-device power management code

2015-10-07T14:16:30+00:00

[ Upstream commit 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 ]

Commit 813f5c0ac5cc ("media: Change media device link_notify behaviour")
modified the media controller link setup notification API and updated the
OMAP3 ISP driver accordingly. As a side effect it introduced a bug by
turning power on after setting the link instead of before. This results in
sub-devices not being powered down in some cases when they should be. Fix
it.

Fixes: 813f5c0ac5cc [media] media: Change media device link_notify behaviour

Signed-off-by: Sakari Ailus 
Cc: stable@vger.kernel.org # since v3.10
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin